PluXml CMS flaws enable XSS and session hijacking
Three vulnerabilities in PluXml CMS allow authenticated attackers to execute stored XSS via SVG uploads and static pages, plus session fixation attacks.
CERT Polska coordinated disclosure of three vulnerabilities affecting PluXml CMS versions 5.8.21 and 5.9.0-rc7, with other versions potentially vulnerable. CVE-2026-24350 is a stored XSS flaw in the file upload functionality that allows authenticated attackers to upload malicious SVG files; when victims click links to these images, the embedded JavaScript executes. In version 5.9.0-rc7, direct file access is still required for exploitation. CVE-2026-24351 affects the static pages editor, enabling users with editing privileges to inject arbitrary HTML and JavaScript that executes when visitors view the modified pages.
CVE-2026-24352 is a session fixation vulnerability that permits attackers to set a victim's session identifier before authentication. Because the session ID persists after login, an attacker can pre-set the token, trick a victim into authenticating with that fixed session, and subsequently hijack the authenticated session. The vendor was notified but did not provide details on the full scope of affected versions. Security researcher Arkadiusz Marta discovered and responsibly reported these issues through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
PluXml SVG Upload Containing Embedded Script Content
Detects upload of SVG files containing inline JavaScript (script tags or event handlers) via PluXml's file upload endpoint, consistent with CVE-2026-24350 stored XSS exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PluXml SVG Upload Containing Embedded Script Content
id: 04eb0547-9079-504f-b3b1-a57b2aaeb352
status: experimental
description: Detects HTTP POST requests uploading .svg files whose body contains script
tags or JavaScript event handlers, matching the PluXml stored XSS file upload vulnerability
(CVE-2026-24350).
references:
- CERT Polska PluXml CMS advisory
logsource:
category: webserver
logsource_notes: applies to web server access/request logs capturing request body
or query for upload endpoints
detection:
selection_upload:
cs-method: POST
cs-uri-stem|contains:
- /upload
- /medias
- /plugins/medias
selection_svg:
cs-uri-query|contains: .svg
selection_script:
cs-uri-query|contains:
- <script
- onload=
- onerror=
- 'javascript:'
condition: selection_upload and selection_svg and selection_script
falsepositives:
- Legitimate SVG uploads containing benign inline styles misidentified due to loose
string matching
- Automated vulnerability scanners testing the CMS
level: high
tags:
- attack.t1059.007
- cve.2026-24350
author: Vorant
PluXml Static Page Editor HTML/JavaScript Injection
Detects POST requests to the PluXml static page editor containing script tags or inline event handlers, indicative of stored XSS injection via CVE-2026-24351. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PluXml Static Page Editor HTML/JavaScript Injection
id: e6d09d4a-183f-5a2c-a82c-0fc2a6f846ab
status: experimental
description: Detects requests to the PluXml static page editing endpoint that include
HTML/JavaScript injection markers, consistent with the stored XSS flaw in the static
pages editor (CVE-2026-24351).
references:
- CERT Polska PluXml CMS advisory
logsource:
category: webserver
detection:
selection_editor:
cs-method: POST
cs-uri-stem|contains:
- /page
- /static
- /edit
selection_injection:
cs-uri-query|contains:
- <script
- onerror=
- onload=
- <iframe
- 'javascript:'
condition: selection_editor and selection_injection
falsepositives:
- Legitimate editors pasting rich HTML content containing similar keywords
- Content migration scripts bulk-updating pages with embedded media tags
level: medium
tags:
- attack.t1059.007
- cve.2026-24351
author: Vorant
Possible Session Fixation via Pre-Set Session Identifier Before Login
Detects HTTP requests to the PluXml login flow where a session identifier is supplied as a query/cookie value prior to authentication, matching the session fixation pattern in CVE-2026-24352. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible Session Fixation via Pre-Set Session Identifier Before Login
id: 936f34fc-20e8-56e7-bd84-a2bae4f59875
status: experimental
description: Detects login requests where a session ID is explicitly passed as a URL
parameter or pre-set cookie value ahead of authentication, consistent with the PluXml
session fixation vulnerability (CVE-2026-24352) allowing attackers to hijack the
resulting authenticated session.
references:
- CERT Polska PluXml CMS advisory
logsource:
category: webserver
detection:
selection_login:
cs-uri-stem|contains:
- /login
- /parametres.php
- /index.php
selection_sid_param:
cs-uri-query|contains:
- PHPSESSID=
- sid=
- session=
condition: selection_login and selection_sid_param
falsepositives:
- Legitimate load balancers or reverse proxies rewriting session cookies as URL parameters
- Applications that intentionally pass session tokens in URLs for cross-domain SSO
level: medium
tags:
- attack.t1185
- cve.2026-24352
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/02/CVE-2026-24350
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free